How to Disable the WordPress REST API (UK Guide 2026)
16 August 2026
Learn how to disable WordPress REST API for security in 2026. Step-by-step UK guide with code snippets, plugins, and best practices.
Why Disable the REST API?
The WordPress REST API is a powerful feature that lets developers interact with your site remotely. However, it also exposes data such as usernames, post meta, and user roles to anyone who knows the right URL. For UK site owners, this can be a security risk, especially if you collect personal data under GDPR. Unauthenticated requests to /wp-json/wp/v2/users can reveal author usernames, which are a common target for brute-force attacks. Disabling or restricting the REST API reduces your attack surface and helps you comply with data protection principles like data minimisation. It's a sensible step for sites that don't rely on the API for functionality.
Method 1: Using a Plugin (Recommended for UK Users)
For beginners, a plugin is the easiest way to disable the REST API. Popular options include Disable REST API, WP Security Ninja, and Wordfence. These plugins are fully maintained and work with UK hosting setups. When choosing a plugin, check for GDPR compliance and that it uses official WordPress security standards. Most plugins let you toggle the API off for logged-out users while keeping it active for admins. This is ideal for UK e-commerce sites that need the API for plugins like WooCommerce but want to block unauthorised access. Remember to update your plugin regularly to avoid introducing new vulnerabilities.
Method 2: Adding Code to functions.php
If you prefer a code-based approach, add a filter to your theme’s functions.php file. Alternatively, create a site-specific plugin to keep your changes separate. The following snippet blocks all REST API requests for non-logged-in users: add_filter('rest_authentication_errors', function($result) { if (!is_user_logged_in()) { return new WP_Error('rest_forbidden', 'REST API access denied.', array('status' => 401)); } return $result; }); This code is simple and effective. For UK developers, test it on a staging site first. Be aware that some plugins and themes may rely on the API for features like block editor saving, so only use this if you understand your site's dependencies. Always back up your site before making code changes.
Selective Disabling: Keep What You Need
Disabling the entire REST API can break features like the block editor, mobile apps, and third-party integrations. A more refined approach is to disable specific routes or limit access based on user roles. For instance, you can remove user enumeration by blocking /wp-json/wp/v2/users, while leaving other endpoints intact. The 'rest_endpoints' filter allows you to unset particular endpoints: add_filter('rest_endpoints', function($endpoints) { if (!is_user_logged_in()) { unset($endpoints['/wp/v2/users']); unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']); } return $endpoints; }); This is particularly useful for UK public sector or news sites that need to comply with open data requirements while protecting personal data. Always review which endpoints your installed plugins use.
Testing and Impact on Your UK Site
After disabling the REST API, thoroughly test your website. Use browser incognito mode to check that public pages load correctly. Run a quick scan with a security tool like WPScan or our own UK-based checks. Verify that forms, comments, and any AJAX functionality still work. If you rely on a contact form plugin, it may use the REST API for submissions; you'll need to whitelist that route. Also, clear any caching plugins like WP Rocket or W3 Total Cache to avoid serving stale API responses. For compliance, document the change in your data processing records, as required by the ICO. This shows you've implemented appropriate technical measures.
FAQ
Yes, it can significantly improve security by blocking unauthorised attempts to read user data or exploit vulnerable endpoints. However, it's not a silver bullet. You should still use strong passwords, two-factor authentication, and keep your core, plugins, and themes updated. Disabling the API simply reduces the attack surface.